@stratusagent/gateway 0.14.0 → 0.14.2

package/dist/index.js

@@ -9,8 +9,8 @@ var __rewriteRelativeImportExtension = (this && this.__rewriteRelativeImportExte
 import { createHash, randomBytes, randomUUID } from 'node:crypto';
 import { mkdir, readFile, rename, rm } from 'node:fs/promises';
 import path from 'node:path';
-import { filePathsOf, isUnaddressedTurn, carriesKey, leastTrusted, senderTrustOf, SENDER_TRUST_METADATA_KEY, workItemState, leftForNextStart, lastResponseIsAnswer, MAX_IDEMPOTENCY_KEY_LENGTH, recordTurnFailure, completeAnsweredTurn, abortErrorFor, sessionTrustOf, sessionWriteTrust, AgentRegistry, AgentRunner, ChannelRegistry, ContributionRegistry, createRoutedMemoryStore, EventBus, RunAbortedError, SkillRegistry, ToolRegistry, createSkillReadTool, missingSkillRequirements, describeToolAllowlistFinding, unmatchedToolAllowlist, CONTEXT_FLOOR_METADATA_KEY, PENDING_APPROVAL_METADATA_KEY, SESSION_TAINTED_BY_METADATA_KEY, SESSION_TRUST_METADATA_KEY, latestTurnReply, readPendingApproval, conversationContextFrom, CONVERSATION_METADATA_KEY, STRATUS_SKILL_ID, imagesWithinReplayBudget, matchesToolAllowlist, } from '@stratusagent/core';
-import { CREDENTIAL_REQUEST_TOOL_NAME, createCredentialRequestTool, createDelegateTool, DELEGATE_TOOL_NAME, createForgetTool, createPinTool, createMessageSendTool, createMessageReadTool, createChannelCreateTool, directMessageReadRefusal, createRecallTool, createRememberTool, createScheduleTools, DELEGATED_BY_METADATA_KEY, DEFAULT_MAX_DELEGATION_DEPTH, DELEGATION_DEPTH_METADATA_KEY, delegatingSessionIdOf, isDelegatedSession, outstandingDelegationFor, ROOT_SESSION_ID_METADATA_KEY, SCHEDULE_ID_METADATA_KEY, SCHEDULED_TURN_METADATA_KEY, withoutDelegation, loadStratusSkill, STRATUS_SKILL_PATH, credentialVariableProblem, } from '@stratusagent/agents';
+import { filePathsOf, isUnaddressedTurn, carriesKey, leastTrusted, senderTrustOf, SENDER_TRUST_METADATA_KEY, workItemState, turnMessageOf, turnKeyOf, leftForNextStart, lastResponseIsAnswer, MAX_IDEMPOTENCY_KEY_LENGTH, recordTurnFailure, completeAnsweredTurn, abortErrorFor, sessionTrustOf, sessionWriteTrust, AgentRegistry, AgentRunner, ChannelRegistry, ContributionRegistry, createRoutedMemoryStore, EventBus, RunAbortedError, SkillRegistry, ToolRegistry, createSkillReadTool, missingSkillRequirements, describeToolAllowlistFinding, unmatchedToolAllowlist, CONTEXT_FLOOR_METADATA_KEY, CONTEXT_SUMMARY_METADATA_KEY, PENDING_APPROVAL_METADATA_KEY, SESSION_TAINTED_BY_METADATA_KEY, SESSION_TRUST_METADATA_KEY, latestTurnReply, readPendingApproval, conversationContextFrom, CONVERSATION_METADATA_KEY, STRATUS_SKILL_ID, imagesWithinReplayBudget, matchesToolAllowlist, } from '@stratusagent/core';
+import { CREDENTIAL_REQUEST_TOOL_NAME, createCredentialRequestTool, createDelegateTool, DELEGATE_TOOL_NAME, createForgetTool, createPinTool, createMessageSendTool, createMessageReadTool, createChannelArchiveTool, createChannelCreateTool, createChannelInviteTool, createChannelJoinTool, directMessageReadRefusal, createRecallTool, createRememberTool, createScheduleTools, DELEGATED_BY_METADATA_KEY, DELEGATED_SESSION_ID_MARKER, DEFAULT_MAX_DELEGATION_DEPTH, DELEGATION_DEPTH_METADATA_KEY, delegatingSessionIdOf, isDelegatedSession, outstandingDelegationFor, ROOT_SESSION_ID_METADATA_KEY, SCHEDULE_ID_METADATA_KEY, SCHEDULED_TURN_METADATA_KEY, withoutDelegation, loadStratusSkill, STRATUS_SKILL_PATH, credentialVariableProblem, } from '@stratusagent/agents';
 import { createFleetReader } from "./fleet.js";
 import { createEventIntake, summarizeEvents, } from "./event-intake.js";
 import { SqliteEventStore } from "./events.js";
@@ -57,6 +57,8 @@ export const STOPPING_TURN_ERROR = 'Run aborted: stratusd is stopping';
  * two windows an operator can hit agree.
  */
 export const DEFAULT_RESTART_DRAIN_TIMEOUT_MS = 30_000;
+/** How long a roster reload waits on one channel's `reload()`. */
+export const DEFAULT_CHANNEL_RELOAD_TIMEOUT_MS = 30_000;
 /**
  * How long a stop lets in-flight turns finish before aborting them. The
  * daemon's documented drain ("up to 30 seconds"), and shorter than the
@@ -200,10 +202,19 @@ const MERGED_SEPARATOR = '\n\n';
  */
 const fitsReplayBudget = (images) => images.length === 0 || imagesWithinReplayBudget([{ id: '', createdAt: '', role: 'user', content: '', images: [...images] }]).size === images.length;
 /** A signal that aborts once every one of `signals` has. */
-const allAborted = (signals) => {
+const allAborted = (signals) => joinableSignal(signals).signal;
+/**
+ * `allAborted` for callers that keep joining: a turn that takes in messages
+ * at its tool steps (card 948) is cancelled only once every caller in it
+ * is, the ones who joined late included. A caller joining with no signal
+ * can never cancel, so from then on neither can the turn.
+ */
+const joinableSignal = (initial) => {
     const controller = new AbortController();
+    const signals = [...initial];
+    let uncancellable = false;
     const check = () => {
-        if (!controller.signal.aborted && signals.every((signal) => signal.aborted)) {
+        if (!uncancellable && !controller.signal.aborted && signals.every((signal) => signal.aborted)) {
             controller.abort(signals[signals.length - 1]?.reason);
         }
     };
@@ -211,8 +222,36 @@ const allAborted = (signals) => {
         signal.addEventListener('abort', check, { once: true });
     }
     check();
-    return controller.signal;
+    return {
+        signal: controller.signal,
+        join: (signal) => {
+            if (signal === undefined) {
+                uncancellable = true;
+                return;
+            }
+            signals.push(signal);
+            signal.addEventListener('abort', check, { once: true });
+        },
+    };
 };
+/**
+ * A value from a form, without the line breaks around it.
+ *
+ * Forms take multi-line values now, so a one-line key copied with the line
+ * break after it would otherwise be stored with it, and fail later inside
+ * whatever header or command it lands in. Only line breaks: a value's own
+ * spaces are its own, as on the CLI.
+ */
+const formCredentialValue = (value) => value.replace(/^[\r\n]+|[\r\n]+$/g, '');
+/**
+ * A PEM block (a private key, a certificate) with no line breaks left, which
+ * is what a one-line field makes of a pasted key file. PEM readers need the
+ * line after the `-----BEGIN …-----` header, so storing it would only move
+ * the failure to the first call that reads the key. Only a value that *is*
+ * one: a PEM inside JSON (a service account file) escapes its line breaks,
+ * so it has none of its own and is fine as sent.
+ */
+const isFlattenedPem = (value) => /^\s*-----BEGIN [A-Z0-9 ]+-----/.test(value) && !value.includes('\n');
 /**
  * Recorded on a turn the previous process was still running when it died.
  *
@@ -335,6 +374,10 @@ export const RESERVED_SESSION_METADATA_KEYS = [
     // no messages and, once it grows past that index, silently stops sending
     // its own earliest turns, with no overflow and no trim event to say so.
     CONTEXT_FLOOR_METADATA_KEY,
+    // The summary that stands in below that floor, for both of the same
+    // reasons, and one more: the model reads it as something it wrote itself,
+    // so a caller who could seed it could put words in the agent's mouth.
+    CONTEXT_SUMMARY_METADATA_KEY,
     SUB_AGENT_METADATA_KEY,
 ];
 /**
@@ -398,26 +441,39 @@ export const createGateway = (options = {}) => {
     // schedule store's own connection (see its docs for why).
     const scheduleStore = new SqliteScheduleStore(fleetDbIn(stateDir), { stateHome: stateDir });
     // ---- events (card 590) ---------------------------------------------------
-    // Opened only for a daemon with sources, so one that never takes events
-    // never grows the tables. Its own connection to fleet.db, like schedules'.
+    // Opened for the first source, so a daemon that never takes events never
+    // grows the tables: at construction for the config's sources, or when the
+    // first plugin feeding a source loads (phase 2), which is at start(),
+    // before the scheduler's start-up pass. Its own connection to fleet.db,
+    // like schedules'.
     const eventSources = options.events?.sources ?? {};
-    const eventStore = Object.keys(eventSources).length > 0
-        ? new SqliteEventStore(fleetDbIn(stateDir), { stateHome: stateDir })
-        : undefined;
-    const eventIntake = eventStore
-        ? createEventIntake({
-            store: eventStore,
-            sources: () => eventSources,
-            // The daemon's own credential, read per delivery: a stored or
-            // rotated secret works on the next one, with no restart.
-            secret: (name) => resolveDaemonCredential(env, name),
-            // The triggers are schedules: `schedule.on` rows on this source.
-            // Late-bound, because the scheduler is built further down.
-            triggers: (sourceId) => scheduler.eventTriggers(sourceId),
-            ...(options.events?.maxBodyBytes !== undefined ? { maxBodyBytes: options.events.maxBodyBytes } : {}),
-            warn,
-        })
-        : undefined;
+    /** Sources plugins feed: source id to the package that declared it, filled as each loads. */
+    const pluginEventSources = new Map();
+    const eventSourceIds = () => [...Object.keys(eventSources), ...pluginEventSources.keys()];
+    let eventStore;
+    let eventIntake;
+    const openEvents = () => {
+        if (!eventStore || !eventIntake) {
+            eventStore = new SqliteEventStore(fleetDbIn(stateDir), { stateHome: stateDir });
+            eventIntake = createEventIntake({
+                store: eventStore,
+                sources: () => eventSources,
+                pluginSources: () => [...pluginEventSources.keys()],
+                // The daemon's own credential, read per delivery: a stored or
+                // rotated secret works on the next one, with no restart.
+                secret: (name) => resolveDaemonCredential(env, name),
+                // The triggers are schedules: `schedule.on` rows on this source.
+                // Late-bound, because the scheduler is built further down.
+                triggers: (sourceId) => scheduler.eventTriggers(sourceId),
+                ...(options.events?.maxBodyBytes !== undefined ? { maxBodyBytes: options.events.maxBodyBytes } : {}),
+                warn,
+            });
+        }
+        return { store: eventStore, intake: eventIntake };
+    };
+    if (Object.keys(eventSources).length > 0) {
+        openEvents();
+    }
     /**
      * The started adapter of one kind that speaks for an agent and has the
      * capability asked for. `carriesOthers` says there were capable adapters
@@ -481,13 +537,28 @@ export const createGateway = (options = {}) => {
             await outboundFor(agentId, destination);
         },
         sessionStatus: async (sessionId) => (await store.get(sessionId))?.status,
+        // Card 858: the previous firing, for the next one's checkpoint. The
+        // reply and its label, never the transcript.
+        previousRun: async (sessionId) => {
+            const session = await store.get(sessionId);
+            if (!session) {
+                return undefined;
+            }
+            const reply = latestTurnReply(session);
+            return {
+                status: session.status,
+                ...(session.stoppedEarly !== undefined ? { stoppedEarly: session.stoppedEarly } : {}),
+                ...(reply !== undefined ? { reply } : {}),
+                trust: sessionWriteTrust(session),
+            };
+        },
         hasAgent: (agentId) => registry.get(agentId) !== undefined,
         ...(options.schedules ? { limits: options.schedules } : {}),
         // The same stamp check every turn runs, before a slot is claimed — see
         // `SchedulerRuntimeOptions.ready`.
         ready: () => assertStateCompatible(env),
         paused: () => intakeState.paused,
-        ...(eventStore ? { events: { store: eventStore, sources: () => Object.keys(eventSources) } } : {}),
+        ...(eventStore ? { events: { store: eventStore, sources: eventSourceIds } } : {}),
         log,
         warn,
     });
@@ -1168,6 +1239,59 @@ export const createGateway = (options = {}) => {
         reloads = next.catch(() => undefined);
         await next;
     };
+    const channelReloadTimeoutMs = options.channelReloadTimeoutMs ?? DEFAULT_CHANNEL_RELOAD_TIMEOUT_MS;
+    /**
+     * After a roster reload, each started channel that can picks up the
+     * agents it carries now (a new agent's stored app, one whose soul or
+     * secrets are gone). One at a time, in start order, so the log reads in
+     * the order an operator configured them. A channel that fails is
+     * logged and the rest still reload: one bad app must not hold back the
+     * others, the rule `startChannels` follows. A channel still reloading
+     * after the bound is left to finish on its own, and what it ends with is
+     * logged then, so a hung Slack call cannot hold every later reload.
+     */
+    const reloadChannels = async () => {
+        const outcomes = [];
+        for (const adapter of [...startedChannels]) {
+            if (stopping || channelsClosed) {
+                return outcomes;
+            }
+            if (typeof adapter.reload !== 'function') {
+                continue;
+            }
+            const reload = adapter.reload.bind(adapter);
+            // Settles with the failure, never rejects: one that comes after the
+            // bound has nobody awaiting it, and would take the daemon down.
+            const settled = (async () => reload())().then(() => undefined, (error) => (error instanceof Error ? error.message : String(error)));
+            let timer;
+            const bound = new Promise((resolve) => {
+                timer = setTimeout(() => resolve('timeout'), channelReloadTimeoutMs);
+                timer.unref?.();
+            });
+            const outcome = await Promise.race([settled.then((failure) => ({ failure })), bound]);
+            clearTimeout(timer);
+            if (outcome === 'timeout') {
+                warn(`channel ${adapter.name} is still reloading after ${channelReloadTimeoutMs} ms; the roster reload goes on without it`);
+                void settled.then((failure) => {
+                    if (failure !== undefined) {
+                        warn(`channel ${adapter.name} could not reload: ${failure}`);
+                    }
+                    else {
+                        log(`channel ${adapter.name} finished reloading`);
+                    }
+                });
+                outcomes.push({ name: adapter.name, outcome: 'still-reloading' });
+                continue;
+            }
+            if (outcome.failure !== undefined) {
+                warn(`channel ${adapter.name} could not reload: ${outcome.failure}`);
+                outcomes.push({ name: adapter.name, outcome: 'failed', reason: outcome.failure });
+                continue;
+            }
+            outcomes.push({ name: adapter.name, outcome: 'reloaded' });
+        }
+        return outcomes;
+    };
     /**
      * A session pins its agent id, never a snapshot of the agent: the soul
      * file is re-read on every dispatch, so an edited persona (or tool
@@ -1320,6 +1444,128 @@ export const createGateway = (options = {}) => {
         }
         return adapter.createConversation({ agentId, ...request });
     }));
+    // Joining and inviting follow the same rule: the asking agent's own app
+    // does it, so membership stays per app and its token stays in the adapter.
+    tools.register(createChannelJoinTool(async ({ agentId, channel, conversation }) => {
+        const { adapter, carriesOthers } = channelCarrying(channel, agentId, (candidate) => candidate.joinConversation !== undefined);
+        if (!adapter?.joinConversation) {
+            throw new Error(carriesOthers
+                ? `No running '${channel}' channel carries agent ${agentId}, so it has no app to join a channel with.`
+                : `No running channel can join '${channel}' conversations.`);
+        }
+        return adapter.joinConversation({ agentId, conversation });
+    }));
+    tools.register(createChannelInviteTool(async ({ agentId, channel, ...request }) => {
+        const { adapter, carriesOthers } = channelCarrying(channel, agentId, (candidate) => candidate.inviteToConversation !== undefined);
+        if (!adapter?.inviteToConversation) {
+            throw new Error(carriesOthers
+                ? `No running '${channel}' channel carries agent ${agentId}, so it has no app to invite anyone with.`
+                : `No running channel can invite people to '${channel}' conversations.`);
+        }
+        return adapter.inviteToConversation({ agentId, ...request });
+    }));
+    /**
+     * Why a `channel.archive` call would archive the conversation its work was
+     * asked from, or can't tell, as a sentence; undefined when it may go on.
+     * That conversation is never archived: the answer to it would have
+     * nowhere to go, and the agent can't unarchive.
+     *
+     * An ordinary session is its own origin. A sub-agent's or a delegated
+     * run's is the root turn that started the chain, read off the id the
+     * host minted for it (each child id is its parent's plus a marker, so the
+     * root is the text before the first one), never off metadata a tool in
+     * the slice could rewrite. The id is the one the session had at its first
+     * tool call, for the same reason. The origin's conversation is asked of
+     * the adapter of this kind that carries the origin's agent. When it can't
+     * be told (the root is gone; no adapter, no `sessionConversation`, a
+     * lookup that fails, or no answer for a session whose id is this
+     * channel's), the call is refused: an archive the agent can't undo
+     * doesn't run on a guess. A session that isn't this channel's at all (an
+     * API call, a schedule, a turn on another transport) has no conversation
+     * here to protect.
+     */
+    const archiveRefusal = async (kind, conversation, session, archiving) => {
+        const unknown = (why) => `${kind} ${conversation} was not archived: ${why}, so Stratus can't tell which conversation this work was asked from, `
+            + 'and that one is never archived. Ask for the archive from a conversation.';
+        const id = hostIdOf(session);
+        const marks = [SUB_AGENT_SESSION_ID_MARKER, DELEGATED_SESSION_ID_MARKER]
+            .map((marker) => id.indexOf(marker))
+            .filter((at) => at >= 0);
+        let origin = { agentId: session.agent.id, sessionId: id };
+        let adapter = archiving;
+        if (marks.length > 0) {
+            const rootId = id.slice(0, Math.min(...marks));
+            let root;
+            try {
+                root = rootId ? await store.get(rootId) : undefined;
+            }
+            catch (error) {
+                warn(`${id}: could not read the root session ${rootId} to check a channel.archive (${error instanceof Error ? error.message : String(error)})`);
+                root = undefined;
+            }
+            if (!root) {
+                return unknown('this run was started by another session that no longer exists');
+            }
+            origin = { agentId: root.agent.id, sessionId: root.id };
+            adapter = channelCarrying(kind, origin.agentId, () => true).adapter;
+        }
+        // Channel session ids lead with their kind (`channelSessionKey`).
+        const onThisChannel = origin.sessionId.startsWith(`${kind}:`);
+        if (!adapter) {
+            return onThisChannel ? unknown(`no running '${kind}' channel carries the agent this work was asked of`) : undefined;
+        }
+        if (!adapter.sessionConversation) {
+            return unknown(`the running '${kind}' channel can't say which conversation a session is in`);
+        }
+        let origins;
+        try {
+            origins = adapter.sessionConversation(origin.agentId, origin.sessionId);
+        }
+        catch (error) {
+            warn(`${id}: could not tell which conversation ${origin.sessionId} is in to check a channel.archive (${error instanceof Error ? error.message : String(error)})`);
+            return unknown(`the running '${kind}' channel couldn't say which conversation this work was asked from`);
+        }
+        if (origins === undefined) {
+            return onThisChannel ? unknown(`the running '${kind}' channel can't say which of its conversations this work was asked from`) : undefined;
+        }
+        return origins === conversation
+            ? `${kind} ${conversation} is the conversation this work was asked from, so it was not archived: `
+                + 'the reply would have nowhere to go. Ask for the archive from another conversation.'
+            : undefined;
+    };
+    const archivingAdapter = (kind, agentId) => channelCarrying(kind, agentId, (candidate) => candidate.archiveConversation !== undefined);
+    const noArchivingAdapter = (kind, agentId, carriesOthers) => carriesOthers
+        ? `No running '${kind}' channel carries agent ${agentId}, so it has no app to archive a channel with.`
+        : `No running channel can archive '${kind}' conversations.`;
+    tools.register(createChannelArchiveTool(async ({ agentId, channel, conversation }, session) => {
+        const { adapter, carriesOthers } = archivingAdapter(channel, agentId);
+        if (!adapter?.archiveConversation) {
+            throw new Error(noArchivingAdapter(channel, agentId, carriesOthers));
+        }
+        const refusal = await archiveRefusal(channel, conversation, session, adapter);
+        if (refusal !== undefined) {
+            throw new Error(refusal);
+        }
+        return adapter.archiveConversation({ agentId, conversation });
+    }, {
+        // The same check before anyone is asked: an approval, Always allow
+        // above all, for an archive that is bound to be refused is a question
+        // with no useful answer. Held as an approval wait, like message.read's,
+        // since it runs before any tool event and may read the store.
+        refusalFor: async ({ agentId, channel, conversation }, session) => {
+            const { adapter, carriesOthers } = archivingAdapter(channel, agentId);
+            if (!adapter?.archiveConversation) {
+                return noArchivingAdapter(channel, agentId, carriesOthers);
+            }
+            const release = holdApprovalWait(session.id);
+            try {
+                return await archiveRefusal(channel, conversation, session, adapter);
+            }
+            finally {
+                release();
+            }
+        },
+    }));
     tools.register(createMessageReadTool(async ({ agentId, source, ...window }) => {
         // The same carrying rule as outbound: a read goes through the app of
         // the agent asking, never whichever adapter of that kind is running,
@@ -1654,6 +1900,18 @@ export const createGateway = (options = {}) => {
                 message: `${request.soulPath} now belongs to ${owner}, not ${request.agentId}, so nothing was stored. Ask ${request.agentId} to request it again.`,
             };
         }
+        const value = formCredentialValue(input.value);
+        if (isFlattenedPem(value)) {
+            // Refused, not retired: the same form can still take the key whole.
+            const command = request.scope === 'agent'
+                ? `stratus credential set ${request.name} --agent ${quoteShellArg(request.agentId)} < key.pem`
+                : `stratus credential set ${request.name} < key.pem`;
+            return {
+                ok: false,
+                message: 'That looks like a PEM key whose line breaks were lost, so nothing was stored: whatever reads it would fail. '
+                    + `Paste it again from the original file with its line breaks, or store it on the machine: ${command}.`,
+            };
+        }
         const store = {
             ...(request.scope === 'agent' ? { agentId: request.agentId } : {}),
             // The binding the form promised, written with the value, always for
@@ -1670,7 +1928,7 @@ export const createGateway = (options = {}) => {
                     if (soul.agent.id !== request.agentId || soul.agent.credentials?.includes(request.name) !== true) {
                         return false;
                     }
-                    await replaceNamedCredential(env, { name: request.name, value: input.value, ...store });
+                    await replaceNamedCredential(env, { name: request.name, value, ...store });
                     return true;
                 });
             }
@@ -1709,7 +1967,7 @@ export const createGateway = (options = {}) => {
         try {
             await addNamedCredential(env, {
                 name: request.name,
-                value: input.value,
+                value,
                 ...store,
             });
         }
@@ -2330,6 +2588,23 @@ export const createGateway = (options = {}) => {
     // behind the in-flight turn instead of interleaving with it. Sessions
     // are independent — different conversations run concurrently.
     const sessionChains = new Map();
+    /**
+     * Work queued on each session's chain that has not started, of every
+     * kind (a dispatch, an overheard message, a recovery). What says whether
+     * a merged-turn batch is first in line behind the running turn, which
+     * steering needs (card 948): a batch with anything ahead of it would be
+     * answered before what was said first.
+     */
+    const queuedWork = new Map();
+    const releaseQueued = (sessionId) => {
+        const left = (queuedWork.get(sessionId) ?? 1) - 1;
+        if (left > 0) {
+            queuedWork.set(sessionId, left);
+        }
+        else {
+            queuedWork.delete(sessionId);
+        }
+    };
     /**
      * Dispatches queued behind a session's running turn, per session: what
      * tells an auto-continuing turn that somebody wrote meanwhile, so it
@@ -2567,9 +2842,13 @@ export const createGateway = (options = {}) => {
             return await turn;
         }
         catch (error) {
-            if (input.idempotencyKey !== undefined && error instanceof RunAbortedError && error.resumable) {
+            if (error instanceof RunAbortedError && error.resumable) {
                 const left = await store.get(input.sessionId).catch(() => undefined);
-                if (left !== undefined && workItemState(left, input.idempotencyKey) === 'unfinished' && leftForNextStart(left, error)) {
+                // The dispatch's own key, or, for an unkeyed one whose turn took
+                // keyed messages in at a tool step (card 948), the key the turn has
+                // from them: its steered callers are told what a keyed caller is.
+                const key = input.idempotencyKey ?? (left === undefined ? undefined : turnKeyOf(turnMessageOf(left)));
+                if (left !== undefined && key !== undefined && workItemState(left, key) === 'unfinished' && leftForNextStart(left, error)) {
                     throw leftForNext();
                 }
             }
@@ -2581,7 +2860,9 @@ export const createGateway = (options = {}) => {
      * runs as that, on the parent's resolved provider, with no memory and no
      * soul. Only that path passes it.
      */
-    const dispatchInternal = async (input, absorbedKeys = [], subAgent) => {
+    const dispatchInternal = async (input, absorbedKeys = [], subAgent, 
+    /** See `RunInput.steer`; passed by `dispatch` for an opted-in caller. */
+    steer) => {
         // Re-read on every turn, not once at start: a newer build that stamps
         // the home while this daemon is serving has formats this build does not
         // understand, and a daemon that kept writing into them would be the
@@ -2706,6 +2987,7 @@ export const createGateway = (options = {}) => {
                     ...(hostedLoop ? { hostedLoop } : {}),
                     ...(input.metadata ? { metadata: input.metadata } : {}),
                     runtime: runtimeContextFor(source, config, switchedToFallback, input.metadata),
+                    ...(steer !== undefined ? { steer } : {}),
                     signal,
                 });
             }
@@ -2721,6 +3003,7 @@ export const createGateway = (options = {}) => {
                 ...(input.earlier !== undefined && input.earlier.length > 0 ? { earlier: input.earlier } : {}),
                 metadata,
                 runtime: runtimeContextFor(source, config, switchedToFallback, input.metadata, subAgent !== undefined),
+                ...(steer !== undefined ? { steer } : {}),
                 signal,
             });
         }));
@@ -2920,7 +3203,7 @@ export const createGateway = (options = {}) => {
             // otherwise stay parked for every later start and redelivery to try
             // again. An unkeyed one keeps waiting for a sweep that can, as before.
             const after = await store.get(sessionId).catch(() => undefined);
-            const key = after?.messages.findLast((candidate) => candidate.role === 'user')?.idempotencyKey;
+            const key = after === undefined ? undefined : turnKeyOf(turnMessageOf(after));
             if (after !== undefined && key !== undefined && after.status === 'pending_approval' && workItemState(after, key) === 'unfinished') {
                 await failParked(after, ABANDONED_TURN_ERROR).catch(() => { });
             }
@@ -3031,8 +3314,8 @@ export const createGateway = (options = {}) => {
      * whose caller was never promised anything and is told to send again.
      */
     const settleAbandonedTurn = async (session) => {
-        const message = session.messages.findLast((candidate) => candidate.role === 'user');
-        if (message?.idempotencyKey === undefined) {
+        const message = turnMessageOf(session);
+        if (message === undefined || turnKeyOf(message) === undefined) {
             return failAbandoned(session);
         }
         // An answer already in the transcript is completed whatever came before
@@ -3184,6 +3467,100 @@ export const createGateway = (options = {}) => {
         }
         return settleAbandonedTurn(session);
     };
+    /**
+     * What a running turn takes in at its next tool step (card 948): the
+     * merged-turn batch waiting behind it, whole — leader and absorbed alike
+     * — when it is for the same agent. The dispatches it takes join `into`,
+     * which the running turn settles with its own outcome (`runSteerable`).
+     *
+     * A part cancelled while it waited is refused, as `runMerged` refuses it.
+     * A part whose key this session (or the archive it rolled over from)
+     * already holds is a repeat, and judging a repeat can mean settling a
+     * turn — never something to do from inside one — so such a batch is not
+     * taken: it waits and runs next, merged, where that is judged. Nor while
+     * the gateway is stopping, when the batch is what the drain refuses.
+     */
+    const takeSteered = async (sessionId, agentId, into, 
+    /**
+     * Asked last, with nothing awaited after it: whether the running turn
+     * still takes these callers, joining them to its cancellation if so. A
+     * turn cancelled while the store was read takes nothing, and the batch
+     * waits and runs next, as it would have.
+     */
+    admit) => {
+        const batch = openBatches.get(sessionId);
+        if (stopping || batch === undefined || !batch.firstInLine || batch.agentId !== agentId) {
+            return undefined;
+        }
+        // Until every key in it is checked with nothing awaited since: a message
+        // can join while the store is read, and is checked on the next pass; a
+        // batch closed meanwhile is no longer this turn's to take.
+        const checked = new Set();
+        let session;
+        for (;;) {
+            if (stopping || openBatches.get(sessionId) !== batch) {
+                return undefined;
+            }
+            const unchecked = [batch.leader, ...batch.absorbed].flatMap((part) => (part.input.idempotencyKey !== undefined && !checked.has(part.input.idempotencyKey) ? [part.input.idempotencyKey] : []));
+            if (unchecked.length === 0) {
+                break;
+            }
+            session ??= await store.get(sessionId);
+            for (const key of unchecked) {
+                checked.add(key);
+                if (session !== undefined && (workItemState(session, key) !== undefined || await archivedRepeat(session, key) !== undefined)) {
+                    return undefined;
+                }
+            }
+        }
+        const all = [batch.leader, ...batch.absorbed];
+        if (!admit(all.filter((part) => part.input.signal?.aborted !== true))) {
+            return undefined;
+        }
+        openBatches.delete(sessionId);
+        batch.steered = true;
+        // Its place on the chain runs nothing now, so it is not ahead of a batch
+        // opening behind it, which can then be steered at a later step.
+        releaseQueued(sessionId);
+        // Not waiting any more; the leader's place on the chain does not count it again.
+        const left = (waitingDispatches.get(sessionId) ?? all.length) - all.length;
+        if (left > 0) {
+            waitingDispatches.set(sessionId, left);
+        }
+        else {
+            waitingDispatches.delete(sessionId);
+        }
+        const runnable = [];
+        for (const part of all) {
+            if (part.input.signal?.aborted) {
+                part.reject(abortErrorFor(part.input.signal));
+                continue;
+            }
+            runnable.push(part);
+        }
+        if (runnable.length === 0) {
+            return undefined;
+        }
+        const keys = runnable.flatMap((part) => (part.input.idempotencyKey !== undefined ? [part.input.idempotencyKey] : []));
+        const items = liveWorkItems.get(sessionId);
+        for (const key of keys) {
+            const item = items?.get(key);
+            if (item !== undefined) {
+                item.confirmed = true;
+            }
+        }
+        into.push(...runnable);
+        const labelled = runnable.some((part) => part.input.metadata !== undefined && SENDER_TRUST_METADATA_KEY in part.input.metadata);
+        const lowest = leastTrusted(...runnable.map((part) => senderTrustOf(part.input.metadata)));
+        const images = runnable.flatMap((part) => part.input.images ?? []);
+        log(`${sessionId}: ${runnable.length} message(s) sent during the running turn reached it at its next step`);
+        return {
+            userMessage: runnable.map((part) => part.input.userMessage).join(MERGED_SEPARATOR),
+            ...(images.length > 0 ? { images } : {}),
+            ...(labelled ? { metadata: { [SENDER_TRUST_METADATA_KEY]: lowest } } : {}),
+            ...(keys.length > 0 ? { keys } : {}),
+        };
+    };
     /**
      * Settles a keyed item the last process left unfinished before any other
      * message joins its session. Channels are up before the sweeps reach it,
@@ -3196,7 +3573,7 @@ export const createGateway = (options = {}) => {
      */
     const settleOrphanedItem = async (sessionId) => {
         const session = await store.get(sessionId);
-        const key = session?.messages.findLast((candidate) => candidate.role === 'user')?.idempotencyKey;
+        const key = session === undefined ? undefined : turnKeyOf(turnMessageOf(session));
         if (session !== undefined && key !== undefined && workItemState(session, key) === 'unfinished') {
             // A continuation that fails has failed its session, which is settled
             // too; the message waiting behind it runs either way.
@@ -3227,9 +3604,18 @@ export const createGateway = (options = {}) => {
      * stops that, and it only holds if everything that writes a session goes
      * through it.
      */
-    const onSessionChain = (sessionId, work) => {
+    const onSessionChain = (sessionId, work, 
+    /** True once this work no longer counts as queued: a batch steered into the turn ahead (`takeSteered` released it). */
+    released) => {
         const previous = sessionChains.get(sessionId) ?? Promise.resolve();
-        const turn = previous.then(work, work);
+        queuedWork.set(sessionId, (queuedWork.get(sessionId) ?? 0) + 1);
+        const start = () => {
+            if (released?.() !== true) {
+                releaseQueued(sessionId);
+            }
+            return work();
+        };
+        const turn = previous.then(start, start);
         const settled = turn.catch(() => { });
         sessionChains.set(sessionId, settled);
         inflight.add(settled);
@@ -3438,7 +3824,16 @@ export const createGateway = (options = {}) => {
         // Otherwise it leads a new batch, if it is waiting behind a turn at all:
         // a message to an idle session runs at once, alone.
         const batch = mergeable && sessionChains.has(input.sessionId)
-            ? { agentId: input.agentId, absorbed: [], images: [...(input.images ?? [])], chars: input.userMessage.length }
+            ? {
+                agentId: input.agentId,
+                // Settled through `settleLeader`, read when called: it is assigned below.
+                leader: { input, resolve: (session) => settleLeader({ session }), reject: (error) => settleLeader({ error }) },
+                firstInLine: (queuedWork.get(input.sessionId) ?? 0) === 0,
+                absorbed: [],
+                steered: false,
+                images: [...(input.images ?? [])],
+                chars: input.userMessage.length,
+            }
             : undefined;
         if (batch !== undefined) {
             openBatches.set(input.sessionId, batch);
@@ -3540,7 +3935,7 @@ export const createGateway = (options = {}) => {
                 activeTurns.set(input.sessionId, merged.turnId);
             }
             try {
-                outcome = { session: await dispatchInternal(merged, absorbedKeys) };
+                outcome = { session: await runSteerable(merged, absorbedKeys) };
             }
             catch (error) {
                 outcome = { error };
@@ -3574,7 +3969,59 @@ export const createGateway = (options = {}) => {
             settleLeader = (outcome) => ('error' in outcome ? reject(outcome.error) : resolve(outcome.session));
         });
         waitingDispatches.set(input.sessionId, (waitingDispatches.get(input.sessionId) ?? 0) + 1);
+        /**
+         * Runs this dispatch's turn, handing it whatever queues behind it at
+         * each tool step (`takeSteered`), then settles every dispatch it took
+         * with the turn's outcome — the outcome they joined. Only for a caller
+         * that opted into merged turns: it is the one that renders an answer
+         * covering messages other than its own.
+         */
+        const runSteerable = async (turnInput, absorbedKeys = []) => {
+            const steered = [];
+            // Cancelled only when every caller in it is, as a merged turn is, the
+            // ones steered in later included: one caller giving up must not take
+            // the others' answer with it. A turn with a caller who cannot cancel
+            // has no signal to join.
+            const joint = turnInput.signal !== undefined ? joinableSignal([turnInput.signal]) : undefined;
+            const steer = mergeable
+                ? () => takeSteered(input.sessionId, input.agentId, steered, (parts) => {
+                    if (joint?.signal.aborted === true) {
+                        return false;
+                    }
+                    for (const part of parts) {
+                        joint?.join(part.input.signal);
+                    }
+                    return true;
+                })
+                : undefined;
+            const running = joint !== undefined ? { ...turnInput, signal: joint.signal } : turnInput;
+            let outcome;
+            try {
+                outcome = { session: await dispatchInternal(running, absorbedKeys, undefined, steer) };
+            }
+            catch (error) {
+                outcome = { error };
+            }
+            for (const part of steered) {
+                part.input.onAbsorbed?.();
+                if ('session' in outcome) {
+                    part.resolve(outcome.session);
+                }
+                else {
+                    part.reject(outcome.error);
+                }
+            }
+            if ('error' in outcome) {
+                throw outcome.error;
+            }
+            return outcome.session;
+        };
         const chained = onSessionChain(input.sessionId, async () => {
+            // Steered into the turn that ran ahead of it, which has answered and
+            // settled everyone in the batch already — this caller included.
+            if (batch?.steered === true) {
+                return turn;
+            }
             // The batch closes here: anything arriving from now on waits behind
             // this turn and leads the next one.
             if (batch !== undefined && openBatches.get(input.sessionId) === batch) {
@@ -3609,11 +4056,11 @@ export const createGateway = (options = {}) => {
             }
             await settleOrphanedItem(input.sessionId);
             if (turnId === undefined) {
-                return dispatchInternal(input);
+                return runSteerable(input);
             }
             activeTurns.set(input.sessionId, turnId);
             try {
-                return await dispatchInternal(input);
+                return await runSteerable(input);
             }
             finally {
                 // Unconditional, and safe to be: the chain guarantees no other turn
@@ -3621,7 +4068,7 @@ export const createGateway = (options = {}) => {
                 // only ever be clearing its own entry.
                 activeTurns.delete(input.sessionId);
             }
-        });
+        }, () => batch?.steered === true);
         // A second settle (a leader already settled early) is a no-op.
         chained.then((session) => settleLeader({ session }), (error) => settleLeader({ error }));
         if (idempotencyKey !== undefined) {
@@ -3754,6 +4201,41 @@ export const createGateway = (options = {}) => {
                 onRead: (method) => log(`fleet read: ${method} by plugin ${packageName}`),
             }),
             providerCallGuards,
+            eventSources: {
+                reserved: Object.keys(eventSources),
+                register: (packageName, sourceIds) => {
+                    if (!eventStore) {
+                        // The first source on a daemon whose config has none: the
+                        // scheduler was built without events, so it takes them now,
+                        // before its start-up pass reads what is waiting. First, so a
+                        // store that won't open refuses the plugin with no source left
+                        // behind.
+                        scheduler.attachEvents({ store: openEvents().store, sources: eventSourceIds });
+                    }
+                    for (const sourceId of sourceIds) {
+                        pluginEventSources.set(sourceId, packageName);
+                    }
+                },
+                ingest: async (packageName, sourceId, event) => {
+                    if (pluginEventSources.get(sourceId) !== packageName) {
+                        throw new Error(`Plugin ${packageName} does not feed event source "${sourceId}" on this daemon.`);
+                    }
+                    // The store closes last in a stop. Until then an event is kept
+                    // and goes out from the next start; after, refused, so a poller
+                    // keeps its cursor where it was.
+                    if (storesClosed) {
+                        throw new Error('stratusd has stopped, so this event was not stored. Feed it again once the daemon is back.');
+                    }
+                    const answer = openEvents().intake.ingest(sourceId, event);
+                    // Sent now rather than at the next tick; the scheduler decides
+                    // hold or fire, and does nothing while it is stopped or not yet
+                    // started.
+                    if (answer.status === 'matched') {
+                        scheduler.kickEvents();
+                    }
+                    return answer;
+                },
+            },
         });
         loadedPlugins = result.loaded;
         pluginFailures = result.failures;
@@ -3766,6 +4248,7 @@ export const createGateway = (options = {}) => {
                 ...plugin.contributions.memory.map((name) => `memory store ${name}`),
                 ...plugin.contributions.executors.map((name) => `executor ${name}`),
                 ...(plugin.providerCallGuards > 0 ? ['guards model calls'] : []),
+                ...plugin.eventSources.map((sourceId) => `event source ${sourceId}`),
             ];
             log(`plugin ${plugin.package} loaded — ${contributed.join(', ') || 'no tools'}`);
         }
@@ -4448,12 +4931,23 @@ export const createGateway = (options = {}) => {
             return registry.list();
         },
         async reloadRoster() {
-            // Under the soul lock, so a repoint cannot land between a credential
-            // grant's check of the served path and its write (`grantSoulCredential`).
-            await reloadsInOrder(() => withSoulFileLock(loadRoster));
-            const roster = registry.list();
-            log(`roster reloaded — ${roster.length} agent(s): ${roster.map((agent) => agent.name).join(', ')}`);
-            return roster;
+            return (await gateway.reloadRosterAndChannels()).agents;
+        },
+        async reloadRosterAndChannels() {
+            let roster = [];
+            let channels = [];
+            await reloadsInOrder(async () => {
+                // Under the soul lock, so a repoint cannot land between a credential
+                // grant's check of the served path and its write (`grantSoulCredential`).
+                await withSoulFileLock(loadRoster);
+                roster = registry.list();
+                log(`roster reloaded — ${roster.length} agent(s): ${roster.map((agent) => agent.name).join(', ')}`);
+                // Outside the soul lock, which guards files and must not wait on a
+                // network; inside the reload chain, so two reloads never interleave
+                // their channel work (the bound keeps one from holding it).
+                channels = await reloadChannels();
+            });
+            return { agents: roster, channels };
         },
         async reloadSkills() {
             try {
@@ -4559,7 +5053,13 @@ export const createGateway = (options = {}) => {
             if (!eventStore || !eventIntake) {
                 return { since, sources: {}, unknownSource: 0 };
             }
-            return summarizeEvents({ sourceIds: Object.keys(eventSources), since, activity: eventStore.activity(since), counters: eventIntake.counters() });
+            return summarizeEvents({
+                sourceIds: eventSourceIds(),
+                plugins: Object.fromEntries(pluginEventSources),
+                since,
+                activity: eventStore.activity(since),
+                counters: eventIntake.counters(),
+            });
         },
         eventDeliveries(options = {}) {
             return eventStore?.deliveries(options) ?? [];